@matter/thread-br-client 0.0.1

package/dist/cjs/dtls/ecjpake/EcJpakePms.js

@@ -0,0 +1,61 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var EcJpakePms_exports = {};
+__export(EcJpakePms_exports, {
+  EcJpakePms: () => EcJpakePms
+});
+module.exports = __toCommonJS(EcJpakePms_exports);
+var import_general = require("@matter/general");
+var import_nist = require("@noble/curves/nist.js");
+var import_sha2 = require("@noble/hashes/sha2.js");
+var import_DtlsChannel = require("../channel/DtlsChannel.js");
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+const Point = import_nist.p256.Point;
+const N = Point.Fn.ORDER;
+const COORDINATE_BYTES = 32;
+const EcJpakePms = {
+  derive(args) {
+    const { Xp, Xp2, xm2, s } = args;
+    if (xm2 <= 0n || xm2 >= N) {
+      throw new import_general.InternalError("xm2 must be in [1, n-1]");
+    }
+    if (s <= 0n) {
+      throw new import_general.InternalError("s (password as integer) must be positive");
+    }
+    const Xp_pt = Point.fromBytes(Xp);
+    const Xp2_pt = Point.fromBytes(Xp2);
+    if (Xp_pt.is0() || Xp2_pt.is0()) {
+      throw new import_DtlsChannel.DtlsError("peer points must not be the point at infinity");
+    }
+    const xm2sNeg = (N - xm2 * s % N) % N;
+    const K1 = Xp_pt.add(Xp2_pt.multiply(xm2sNeg));
+    const K = K1.multiply(xm2);
+    if (K.is0()) {
+      throw new import_DtlsChannel.DtlsError("derived K is the point at infinity");
+    }
+    const sec1 = K.toBytes(false);
+    const xBytes = sec1.subarray(1, 1 + COORDINATE_BYTES);
+    return (0, import_sha2.sha256)(xBytes);
+  }
+};
+//# sourceMappingURL=EcJpakePms.js.map

package/dist/cjs/dtls/ecjpake/EcJpakePms.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/dtls/ecjpake/EcJpakePms.ts"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,qBAA8B;AAC9B,kBAAqB;AACrB,kBAAuB;AACvB,yBAA0B;AAT1B;AAAA;AAAA;AAAA;AAAA;AAWA,MAAM,QAAQ,iBAAK;AACnB,MAAM,IAAI,MAAM,GAAG;AACnB,MAAM,mBAAmB;AAuBlB,MAAM,aAAa;AAAA,EACtB,OAAO,MAA+E;AAClF,UAAM,EAAE,IAAI,KAAK,KAAK,EAAE,IAAI;AAC5B,QAAI,OAAO,MAAM,OAAO,GAAG;AACvB,YAAM,IAAI,6BAAc,yBAAyB;AAAA,IACrD;AACA,QAAI,KAAK,IAAI;AACT,YAAM,IAAI,6BAAc,0CAA0C;AAAA,IACtE;AACA,UAAM,QAAQ,MAAM,UAAU,EAAE;AAChC,UAAM,SAAS,MAAM,UAAU,GAAG;AAClC,QAAI,MAAM,IAAI,KAAK,OAAO,IAAI,GAAG;AAC7B,YAAM,IAAI,6BAAU,+CAA+C;AAAA,IACvE;AACA,UAAM,WAAW,IAAM,MAAM,IAAK,KAAM;AAExC,UAAM,KAAK,MAAM,IAAI,OAAO,SAAS,OAAO,CAAC;AAC7C,UAAM,IAAI,GAAG,SAAS,GAAG;AACzB,QAAI,EAAE,IAAI,GAAG;AACT,YAAM,IAAI,6BAAU,oCAAoC;AAAA,IAC5D;AAIA,UAAM,OAAO,EAAE,QAAQ,KAAK;AAC5B,UAAM,SAAS,KAAK,SAAS,GAAG,IAAI,gBAAgB;AACpD,eAAO,oBAAO,MAAM;AAAA,EACxB;AACJ;",
+  "names": []
+}

package/dist/cjs/dtls/ecjpake/EcJpakeRound.d.ts

@@ -0,0 +1,119 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { SchnorrZkp, type SchnorrZkpGenerator } from "./SchnorrZkp.js";
+/**
+ * One half of an EC-JPAKE round-1 message: an ephemeral public key plus a Schnorr
+ * proof of knowledge of its private scalar against the curve generator.
+ *
+ * Wire (mbedTLS v3.6.6 `ecjpake_kkp_write`):
+ * ```
+ * uint8 X_len; uint8 X[X_len];          // X_len = 65 for P-256 uncompressed
+ * uint8 V_len; uint8 V[V_len];          // V_len = 65 for P-256 uncompressed
+ * uint8 r_len; uint8 r[r_len];          // r_len is minimal, leading zeros stripped
+ * ```
+ */
+export interface EcJpakeKeyKP {
+    /** SEC1-uncompressed public key `X = x*G`. */
+    X: Uint8Array;
+    /** Schnorr ZKP proving knowledge of `x`. */
+    zkp: SchnorrZkp;
+}
+/**
+ * EC-JPAKE participant identifiers used in the ZKP challenge hash. These are the literal
+ * byte strings from mbedTLS `ecjpake_id[]` (mbedtls v3.6.6 `library/ecjpake.c`); the wire
+ * value is a hash input on both sides, so the strings must match between client and server.
+ */
+export declare const ECJPAKE_ID_CLIENT = "client";
+export declare const ECJPAKE_ID_SERVER = "server";
+/**
+ * EC-JPAKE round 1 codec on top of the wire format that mbedTLS calls
+ * `ECJPAKEKeyKPPairList`: two `ECJPAKEKeyKP` structures back-to-back, no separator,
+ * no outer length (the carrying TLS extension layer adds the 2-byte length on the wire).
+ *
+ * Mirrors mbedTLS `ecjpake_kkpp_write` / `ecjpake_kkpp_read`.
+ */
+export declare const EcJpakeRound: {
+    /**
+     * Build a round-1 message for one role from two private scalars and two ephemeral
+     * scalars (one ephemeral per ZKP). Caller-supplied ephemerals make the output
+     * deterministic for testing — production callers must source them from a CSPRNG.
+     *
+     * `id` is `ECJPAKE_ID_CLIENT` for the joiner and `ECJPAKE_ID_SERVER` for the commissioner.
+     */
+    buildRound1(args: {
+        x1: bigint;
+        x2: bigint;
+        v1: bigint;
+        v2: bigint;
+        id: string;
+    }): {
+        kp1: EcJpakeKeyKP;
+        kp2: EcJpakeKeyKP;
+    };
+    serializeRound1(kp1: EcJpakeKeyKP, kp2: EcJpakeKeyKP): Uint8Array;
+    parseRound1(bytes: Uint8Array): {
+        kp1: EcJpakeKeyKP;
+        kp2: EcJpakeKeyKP;
+    };
+    /**
+     * Compute the round-2 composite generator `G' = Xp1 + Xp2 + Xm1` (mbedTLS
+     * `ecjpake_kkpp_write_round_two` / `ecjpake_kkpp_read_round_two`).
+     * Both sides use the same formula by symmetry — for the client `Xp1 = X3`,
+     * `Xp2 = X4`, `Xm1 = X1`; for the server `Xp1 = X1`, `Xp2 = X2`, `Xm1 = X3`.
+     */
+    composeRound2Generator(args: {
+        Xp1: Uint8Array;
+        Xp2: Uint8Array;
+        Xm1: Uint8Array;
+    }): SchnorrZkpGenerator;
+    /**
+     * Build round 2 from the second private scalar `xm2`, the password (as the
+     * mbedTLS-style big-endian integer `s`), the composite generator `G'`, and a
+     * deterministic ephemeral `v`. Returns `Xm = (xm2 * s) * G'` plus a Schnorr
+     * ZKP proving knowledge of `xm = xm2 * s mod n` against `G'`.
+     *
+     * Caller-supplied `v` makes output deterministic for testing; production
+     * callers must source `v` from a CSPRNG.
+     */
+    buildRound2(args: {
+        xm2: bigint;
+        s: bigint;
+        v: bigint;
+        id: string;
+        generator: SchnorrZkpGenerator;
+    }): EcJpakeKeyKP;
+    /**
+     * Serialise a round-2 message. When `prependEcParameters` is true the 3-byte
+     * `ECParameters{ named_curve, secp256r1 }` header is emitted before the
+     * `ECJPAKEKeyKP`. mbedTLS writes it inside `mbedtls_ecjpake_write_round_two`
+     * when role=SERVER (consumed by `ssl_write_server_key_exchange`).
+     * Server-side messages (ServerKeyExchange) use `true`; client-side
+     * (ClientKeyExchange) uses `false`.
+     */
+    serializeRound2(kp: EcJpakeKeyKP, options: {
+        prependEcParameters: boolean;
+    }): Uint8Array;
+    /**
+     * Parse a round-2 message. `expectEcParameters` must be `true` when the parser
+     * is the client reading ServerKeyExchange, and `false` when the parser is the
+     * server reading ClientKeyExchange.
+     */
+    parseRound2(bytes: Uint8Array, options: {
+        expectEcParameters: boolean;
+    }): EcJpakeKeyKP;
+    /**
+     * Verify the embedded round-2 ZKP under the supplied composite generator
+     * and the peer's `id` ("client" or "server"). Returns `false` (does not throw)
+     * on any verification failure — including malformed bytes — to mirror the
+     * round-1 `SchnorrZkp.verify` contract.
+     */
+    verifyRound2Zkp(args: {
+        kp: EcJpakeKeyKP;
+        generator: SchnorrZkpGenerator;
+        peerId: string;
+    }): boolean;
+};
+//# sourceMappingURL=EcJpakeRound.d.ts.map

package/dist/cjs/dtls/ecjpake/EcJpakeRound.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EcJpakeRound.d.ts","sourceRoot":"","sources":["../../../../src/dtls/ecjpake/EcJpakeRound.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,EAAE,UAAU,EAAE,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEvE;;;;;;;;;;GAUG;AACH,MAAM,WAAW,YAAY;IACzB,8CAA8C;IAC9C,CAAC,EAAE,UAAU,CAAC;IACd,4CAA4C;IAC5C,GAAG,EAAE,UAAU,CAAC;CACnB;AAMD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,WAAW,CAAC;AAC1C,eAAO,MAAM,iBAAiB,WAAW,CAAC;AAqF1C;;;;;;GAMG;AACH,eAAO,MAAM,YAAY;IACrB;;;;;;OAMG;IACH,WAAW,OAAO;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG;QAC/E,GAAG,EAAE,YAAY,CAAC;QAClB,GAAG,EAAE,YAAY,CAAC;KACrB;IAYD,eAAe,MAAM,YAAY,OAAO,YAAY,GAAG,UAAU;IASjE,WAAW,QAAQ,UAAU,GAAG;QAAE,GAAG,EAAE,YAAY,CAAC;QAAC,GAAG,EAAE,YAAY,CAAA;KAAE;IASxE;;;;;OAKG;IACH,sBAAsB,OAAO;QAAE,GAAG,EAAE,UAAU,CAAC;QAAC,GAAG,EAAE,UAAU,CAAC;QAAC,GAAG,EAAE,UAAU,CAAA;KAAE,GAAG,mBAAmB;IAQxG;;;;;;;;OAQG;IACH,WAAW,OAAO;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,mBAAmB,CAAA;KAAE,GAAG,YAAY;IAwBlH;;;;;;;OAOG;IACH,eAAe,KAAK,YAAY,WAAW;QAAE,mBAAmB,EAAE,OAAO,CAAA;KAAE,GAAG,UAAU;IAcxF;;;;OAIG;IACH,WAAW,QAAQ,UAAU,WAAW;QAAE,kBAAkB,EAAE,OAAO,CAAA;KAAE,GAAG,YAAY;IAsBtF;;;;;OAKG;IACH,eAAe,OAAO;QAAE,EAAE,EAAE,YAAY,CAAC;QAAC,SAAS,EAAE,mBAAmB,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO;CAI9F,CAAC"}

package/dist/cjs/dtls/ecjpake/EcJpakeRound.js

@@ -0,0 +1,248 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var EcJpakeRound_exports = {};
+__export(EcJpakeRound_exports, {
+  ECJPAKE_ID_CLIENT: () => ECJPAKE_ID_CLIENT,
+  ECJPAKE_ID_SERVER: () => ECJPAKE_ID_SERVER,
+  EcJpakeRound: () => EcJpakeRound
+});
+module.exports = __toCommonJS(EcJpakeRound_exports);
+var import_general = require("@matter/general");
+var import_nist = require("@noble/curves/nist.js");
+var import_DtlsChannel = require("../channel/DtlsChannel.js");
+var import_SchnorrZkp = require("./SchnorrZkp.js");
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+const Point = import_nist.p256.Point;
+const N = Point.Fn.ORDER;
+const POINT_LEN = 65;
+const ECJPAKE_ID_CLIENT = "client";
+const ECJPAKE_ID_SERVER = "server";
+function readU8(bytes, offset) {
+  if (offset >= bytes.length) {
+    throw new import_DtlsChannel.DtlsError(`unexpected end of buffer at offset ${offset}`);
+  }
+  return bytes[offset];
+}
+function readSlice(bytes, offset, length) {
+  if (offset + length > bytes.length) {
+    throw new import_DtlsChannel.DtlsError(
+      `buffer too short: need ${length} bytes at offset ${offset}, have ${bytes.length - offset}`
+    );
+  }
+  return bytes.slice(offset, offset + length);
+}
+function validateKeyKP(keyKP) {
+  if (keyKP.X.length !== POINT_LEN || keyKP.X[0] !== 4) {
+    throw new import_general.InternalError("X must be SEC1-uncompressed P-256 (65 bytes, 0x04 prefix)");
+  }
+  if (keyKP.zkp.V.length !== POINT_LEN || keyKP.zkp.V[0] !== 4) {
+    throw new import_general.InternalError("ZKP.V must be SEC1-uncompressed P-256 (65 bytes, 0x04 prefix)");
+  }
+  if (keyKP.zkp.r.length === 0 || keyKP.zkp.r.length > 255) {
+    throw new import_general.InternalError(`ZKP.r length must be 1..255, got ${keyKP.zkp.r.length}`);
+  }
+  if (keyKP.zkp.r[0] === 0) {
+    throw new import_general.InternalError("ZKP.r must be minimal big-endian (no leading zero)");
+  }
+}
+function keyKpEncodedLength(keyKP) {
+  return 1 + POINT_LEN + 1 + POINT_LEN + 1 + keyKP.zkp.r.length;
+}
+function writeKeyKP(keyKP, out, offset) {
+  let p = offset;
+  out[p++] = POINT_LEN;
+  out.set(keyKP.X, p);
+  p += POINT_LEN;
+  out[p++] = POINT_LEN;
+  out.set(keyKP.zkp.V, p);
+  p += POINT_LEN;
+  out[p++] = keyKP.zkp.r.length;
+  out.set(keyKP.zkp.r, p);
+  p += keyKP.zkp.r.length;
+  return p;
+}
+function readKeyKP(bytes, offset) {
+  let p = offset;
+  const xLen = readU8(bytes, p);
+  p += 1;
+  if (xLen !== POINT_LEN) {
+    throw new import_DtlsChannel.DtlsError(`expected P-256 point length ${POINT_LEN}, got ${xLen}`);
+  }
+  const X = readSlice(bytes, p, xLen);
+  p += xLen;
+  const vLen = readU8(bytes, p);
+  p += 1;
+  if (vLen !== POINT_LEN) {
+    throw new import_DtlsChannel.DtlsError(`expected P-256 ZKP.V length ${POINT_LEN}, got ${vLen}`);
+  }
+  const V = readSlice(bytes, p, vLen);
+  p += vLen;
+  const rLen = readU8(bytes, p);
+  p += 1;
+  if (rLen === 0) {
+    throw new import_DtlsChannel.DtlsError("ZKP.r length must be > 0");
+  }
+  const r = readSlice(bytes, p, rLen);
+  p += rLen;
+  return {
+    kp: { X, zkp: { V, r } },
+    nextOffset: p
+  };
+}
+const EcJpakeRound = {
+  /**
+   * Build a round-1 message for one role from two private scalars and two ephemeral
+   * scalars (one ephemeral per ZKP). Caller-supplied ephemerals make the output
+   * deterministic for testing — production callers must source them from a CSPRNG.
+   *
+   * `id` is `ECJPAKE_ID_CLIENT` for the joiner and `ECJPAKE_ID_SERVER` for the commissioner.
+   */
+  buildRound1(args) {
+    const { x1, x2, v1, v2, id } = args;
+    const X1 = Point.BASE.multiply(x1).toBytes(false);
+    const X2 = Point.BASE.multiply(x2).toBytes(false);
+    const zkp1 = import_SchnorrZkp.SchnorrZkp.generate({ privateKey: x1, publicKey: X1, ephemeral: v1, id });
+    const zkp2 = import_SchnorrZkp.SchnorrZkp.generate({ privateKey: x2, publicKey: X2, ephemeral: v2, id });
+    return {
+      kp1: { X: X1, zkp: zkp1 },
+      kp2: { X: X2, zkp: zkp2 }
+    };
+  },
+  serializeRound1(kp1, kp2) {
+    validateKeyKP(kp1);
+    validateKeyKP(kp2);
+    const out = new Uint8Array(keyKpEncodedLength(kp1) + keyKpEncodedLength(kp2));
+    const after1 = writeKeyKP(kp1, out, 0);
+    writeKeyKP(kp2, out, after1);
+    return out;
+  },
+  parseRound1(bytes) {
+    const first = readKeyKP(bytes, 0);
+    const second = readKeyKP(bytes, first.nextOffset);
+    if (second.nextOffset !== bytes.length) {
+      throw new import_DtlsChannel.DtlsError(`trailing bytes after round-1 pair: ${bytes.length - second.nextOffset} extra`);
+    }
+    return { kp1: first.kp, kp2: second.kp };
+  },
+  /**
+   * Compute the round-2 composite generator `G' = Xp1 + Xp2 + Xm1` (mbedTLS
+   * `ecjpake_kkpp_write_round_two` / `ecjpake_kkpp_read_round_two`).
+   * Both sides use the same formula by symmetry — for the client `Xp1 = X3`,
+   * `Xp2 = X4`, `Xm1 = X1`; for the server `Xp1 = X1`, `Xp2 = X2`, `Xm1 = X3`.
+   */
+  composeRound2Generator(args) {
+    const point = Point.fromBytes(args.Xp1).add(Point.fromBytes(args.Xp2)).add(Point.fromBytes(args.Xm1));
+    if (point.is0()) {
+      throw new import_DtlsChannel.DtlsError("round-2 generator G' must not be the point at infinity");
+    }
+    return { point, bytes: point.toBytes(false) };
+  },
+  /**
+   * Build round 2 from the second private scalar `xm2`, the password (as the
+   * mbedTLS-style big-endian integer `s`), the composite generator `G'`, and a
+   * deterministic ephemeral `v`. Returns `Xm = (xm2 * s) * G'` plus a Schnorr
+   * ZKP proving knowledge of `xm = xm2 * s mod n` against `G'`.
+   *
+   * Caller-supplied `v` makes output deterministic for testing; production
+   * callers must source `v` from a CSPRNG.
+   */
+  buildRound2(args) {
+    const { xm2, s, v, id, generator } = args;
+    if (xm2 <= 0n || xm2 >= N) {
+      throw new import_general.InternalError("xm2 must be in [1, n-1]");
+    }
+    if (s <= 0n) {
+      throw new import_general.InternalError("s (password as integer) must be positive");
+    }
+    const xm = xm2 * s % N;
+    if (xm === 0n) {
+      throw new import_general.InternalError("xm = xm2*s mod n must be non-zero");
+    }
+    const Xm = generator.point.multiply(xm);
+    const XmBytes = Xm.toBytes(false);
+    const zkp = import_SchnorrZkp.SchnorrZkp.generate({
+      privateKey: xm,
+      publicKey: XmBytes,
+      ephemeral: v,
+      id,
+      generator
+    });
+    return { X: XmBytes, zkp };
+  },
+  /**
+   * Serialise a round-2 message. When `prependEcParameters` is true the 3-byte
+   * `ECParameters{ named_curve, secp256r1 }` header is emitted before the
+   * `ECJPAKEKeyKP`. mbedTLS writes it inside `mbedtls_ecjpake_write_round_two`
+   * when role=SERVER (consumed by `ssl_write_server_key_exchange`).
+   * Server-side messages (ServerKeyExchange) use `true`; client-side
+   * (ClientKeyExchange) uses `false`.
+   */
+  serializeRound2(kp, options) {
+    validateKeyKP(kp);
+    const headerLen = options.prependEcParameters ? 3 : 0;
+    const out = new Uint8Array(headerLen + keyKpEncodedLength(kp));
+    let p = 0;
+    if (options.prependEcParameters) {
+      out[p++] = 3;
+      out[p++] = 0;
+      out[p++] = 23;
+    }
+    writeKeyKP(kp, out, p);
+    return out;
+  },
+  /**
+   * Parse a round-2 message. `expectEcParameters` must be `true` when the parser
+   * is the client reading ServerKeyExchange, and `false` when the parser is the
+   * server reading ClientKeyExchange.
+   */
+  parseRound2(bytes, options) {
+    let p = 0;
+    if (options.expectEcParameters) {
+      if (bytes.length < 3) {
+        throw new import_DtlsChannel.DtlsError("round-2 message too short for ECParameters header");
+      }
+      if (bytes[0] !== 3 || bytes[1] !== 0 || bytes[2] !== 23) {
+        throw new import_DtlsChannel.DtlsError(
+          `expected ECParameters{named_curve, secp256r1} (03 00 17), got ${Array.from(bytes.subarray(0, 3)).map((b) => b.toString(16).padStart(2, "0")).join(" ")}`
+        );
+      }
+      p = 3;
+    }
+    const { kp, nextOffset } = readKeyKP(bytes, p);
+    if (nextOffset !== bytes.length) {
+      throw new import_DtlsChannel.DtlsError(`trailing bytes after round-2 message: ${bytes.length - nextOffset} extra`);
+    }
+    return kp;
+  },
+  /**
+   * Verify the embedded round-2 ZKP under the supplied composite generator
+   * and the peer's `id` ("client" or "server"). Returns `false` (does not throw)
+   * on any verification failure — including malformed bytes — to mirror the
+   * round-1 `SchnorrZkp.verify` contract.
+   */
+  verifyRound2Zkp(args) {
+    const { kp, generator, peerId } = args;
+    return import_SchnorrZkp.SchnorrZkp.verify({ zkp: kp.zkp, publicKey: kp.X, id: peerId, generator });
+  }
+};
+//# sourceMappingURL=EcJpakeRound.js.map

package/dist/cjs/dtls/ecjpake/EcJpakeRound.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/dtls/ecjpake/EcJpakeRound.ts"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,qBAA8B;AAC9B,kBAAqB;AACrB,yBAA0B;AAC1B,wBAAqD;AATrD;AAAA;AAAA;AAAA;AAAA;AA6BA,MAAM,QAAQ,iBAAK;AACnB,MAAM,IAAI,MAAM,GAAG;AACnB,MAAM,YAAY;AAOX,MAAM,oBAAoB;AAC1B,MAAM,oBAAoB;AAEjC,SAAS,OAAO,OAAmB,QAAwB;AACvD,MAAI,UAAU,MAAM,QAAQ;AACxB,UAAM,IAAI,6BAAU,sCAAsC,MAAM,EAAE;AAAA,EACtE;AACA,SAAO,MAAM,MAAM;AACvB;AAEA,SAAS,UAAU,OAAmB,QAAgB,QAA4B;AAC9E,MAAI,SAAS,SAAS,MAAM,QAAQ;AAChC,UAAM,IAAI;AAAA,MACN,0BAA0B,MAAM,oBAAoB,MAAM,UAAU,MAAM,SAAS,MAAM;AAAA,IAC7F;AAAA,EACJ;AAEA,SAAO,MAAM,MAAM,QAAQ,SAAS,MAAM;AAC9C;AAEA,SAAS,cAAc,OAA2B;AAC9C,MAAI,MAAM,EAAE,WAAW,aAAa,MAAM,EAAE,CAAC,MAAM,GAAM;AACrD,UAAM,IAAI,6BAAc,2DAA2D;AAAA,EACvF;AACA,MAAI,MAAM,IAAI,EAAE,WAAW,aAAa,MAAM,IAAI,EAAE,CAAC,MAAM,GAAM;AAC7D,UAAM,IAAI,6BAAc,+DAA+D;AAAA,EAC3F;AACA,MAAI,MAAM,IAAI,EAAE,WAAW,KAAK,MAAM,IAAI,EAAE,SAAS,KAAK;AACtD,UAAM,IAAI,6BAAc,oCAAoC,MAAM,IAAI,EAAE,MAAM,EAAE;AAAA,EACpF;AAIA,MAAI,MAAM,IAAI,EAAE,CAAC,MAAM,GAAM;AACzB,UAAM,IAAI,6BAAc,oDAAoD;AAAA,EAChF;AACJ;AAEA,SAAS,mBAAmB,OAA6B;AACrD,SAAO,IAAI,YAAY,IAAI,YAAY,IAAI,MAAM,IAAI,EAAE;AAC3D;AAEA,SAAS,WAAW,OAAqB,KAAiB,QAAwB;AAC9E,MAAI,IAAI;AACR,MAAI,GAAG,IAAI;AACX,MAAI,IAAI,MAAM,GAAG,CAAC;AAClB,OAAK;AACL,MAAI,GAAG,IAAI;AACX,MAAI,IAAI,MAAM,IAAI,GAAG,CAAC;AACtB,OAAK;AACL,MAAI,GAAG,IAAI,MAAM,IAAI,EAAE;AACvB,MAAI,IAAI,MAAM,IAAI,GAAG,CAAC;AACtB,OAAK,MAAM,IAAI,EAAE;AACjB,SAAO;AACX;AAEA,SAAS,UAAU,OAAmB,QAA0D;AAC5F,MAAI,IAAI;AACR,QAAM,OAAO,OAAO,OAAO,CAAC;AAC5B,OAAK;AACL,MAAI,SAAS,WAAW;AACpB,UAAM,IAAI,6BAAU,+BAA+B,SAAS,SAAS,IAAI,EAAE;AAAA,EAC/E;AACA,QAAM,IAAI,UAAU,OAAO,GAAG,IAAI;AAClC,OAAK;AACL,QAAM,OAAO,OAAO,OAAO,CAAC;AAC5B,OAAK;AACL,MAAI,SAAS,WAAW;AACpB,UAAM,IAAI,6BAAU,+BAA+B,SAAS,SAAS,IAAI,EAAE;AAAA,EAC/E;AACA,QAAM,IAAI,UAAU,OAAO,GAAG,IAAI;AAClC,OAAK;AACL,QAAM,OAAO,OAAO,OAAO,CAAC;AAC5B,OAAK;AACL,MAAI,SAAS,GAAG;AACZ,UAAM,IAAI,6BAAU,0BAA0B;AAAA,EAClD;AACA,QAAM,IAAI,UAAU,OAAO,GAAG,IAAI;AAClC,OAAK;AAEL,SAAO;AAAA,IACH,IAAI,EAAE,GAAG,KAAK,EAAE,GAAG,EAAE,EAAE;AAAA,IACvB,YAAY;AAAA,EAChB;AACJ;AASO,MAAM,eAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQxB,YAAY,MAGV;AACE,UAAM,EAAE,IAAI,IAAI,IAAI,IAAI,GAAG,IAAI;AAC/B,UAAM,KAAK,MAAM,KAAK,SAAS,EAAE,EAAE,QAAQ,KAAK;AAChD,UAAM,KAAK,MAAM,KAAK,SAAS,EAAE,EAAE,QAAQ,KAAK;AAChD,UAAM,OAAO,6BAAW,SAAS,EAAE,YAAY,IAAI,WAAW,IAAI,WAAW,IAAI,GAAG,CAAC;AACrF,UAAM,OAAO,6BAAW,SAAS,EAAE,YAAY,IAAI,WAAW,IAAI,WAAW,IAAI,GAAG,CAAC;AACrF,WAAO;AAAA,MACH,KAAK,EAAE,GAAG,IAAI,KAAK,KAAK;AAAA,MACxB,KAAK,EAAE,GAAG,IAAI,KAAK,KAAK;AAAA,IAC5B;AAAA,EACJ;AAAA,EAEA,gBAAgB,KAAmB,KAA+B;AAC9D,kBAAc,GAAG;AACjB,kBAAc,GAAG;AACjB,UAAM,MAAM,IAAI,WAAW,mBAAmB,GAAG,IAAI,mBAAmB,GAAG,CAAC;AAC5E,UAAM,SAAS,WAAW,KAAK,KAAK,CAAC;AACrC,eAAW,KAAK,KAAK,MAAM;AAC3B,WAAO;AAAA,EACX;AAAA,EAEA,YAAY,OAA6D;AACrE,UAAM,QAAQ,UAAU,OAAO,CAAC;AAChC,UAAM,SAAS,UAAU,OAAO,MAAM,UAAU;AAChD,QAAI,OAAO,eAAe,MAAM,QAAQ;AACpC,YAAM,IAAI,6BAAU,sCAAsC,MAAM,SAAS,OAAO,UAAU,QAAQ;AAAA,IACtG;AACA,WAAO,EAAE,KAAK,MAAM,IAAI,KAAK,OAAO,GAAG;AAAA,EAC3C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,uBAAuB,MAAkF;AACrG,UAAM,QAAQ,MAAM,UAAU,KAAK,GAAG,EAAE,IAAI,MAAM,UAAU,KAAK,GAAG,CAAC,EAAE,IAAI,MAAM,UAAU,KAAK,GAAG,CAAC;AACpG,QAAI,MAAM,IAAI,GAAG;AACb,YAAM,IAAI,6BAAU,wDAAwD;AAAA,IAChF;AACA,WAAO,EAAE,OAAO,OAAO,MAAM,QAAQ,KAAK,EAAE;AAAA,EAChD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,YAAY,MAAuG;AAC/G,UAAM,EAAE,KAAK,GAAG,GAAG,IAAI,UAAU,IAAI;AACrC,QAAI,OAAO,MAAM,OAAO,GAAG;AACvB,YAAM,IAAI,6BAAc,yBAAyB;AAAA,IACrD;AACA,QAAI,KAAK,IAAI;AACT,YAAM,IAAI,6BAAc,0CAA0C;AAAA,IACtE;AACA,UAAM,KAAM,MAAM,IAAK;AACvB,QAAI,OAAO,IAAI;AACX,YAAM,IAAI,6BAAc,mCAAmC;AAAA,IAC/D;AACA,UAAM,KAAK,UAAU,MAAM,SAAS,EAAE;AACtC,UAAM,UAAU,GAAG,QAAQ,KAAK;AAChC,UAAM,MAAM,6BAAW,SAAS;AAAA,MAC5B,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,WAAW;AAAA,MACX;AAAA,MACA;AAAA,IACJ,CAAC;AACD,WAAO,EAAE,GAAG,SAAS,IAAI;AAAA,EAC7B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,gBAAgB,IAAkB,SAAuD;AACrF,kBAAc,EAAE;AAChB,UAAM,YAAY,QAAQ,sBAAsB,IAAI;AACpD,UAAM,MAAM,IAAI,WAAW,YAAY,mBAAmB,EAAE,CAAC;AAC7D,QAAI,IAAI;AACR,QAAI,QAAQ,qBAAqB;AAC7B,UAAI,GAAG,IAAI;AACX,UAAI,GAAG,IAAI;AACX,UAAI,GAAG,IAAI;AAAA,IACf;AACA,eAAW,IAAI,KAAK,CAAC;AACrB,WAAO;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,YAAY,OAAmB,SAAwD;AACnF,QAAI,IAAI;AACR,QAAI,QAAQ,oBAAoB;AAC5B,UAAI,MAAM,SAAS,GAAG;AAClB,cAAM,IAAI,6BAAU,mDAAmD;AAAA,MAC3E;AACA,UAAI,MAAM,CAAC,MAAM,KAAQ,MAAM,CAAC,MAAM,KAAQ,MAAM,CAAC,MAAM,IAAM;AAC7D,cAAM,IAAI;AAAA,UACN,iEAAiE,MAAM,KAAK,MAAM,SAAS,GAAG,CAAC,CAAC,EAC3F,IAAI,OAAK,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EACxC,KAAK,GAAG,CAAC;AAAA,QAClB;AAAA,MACJ;AACA,UAAI;AAAA,IACR;AACA,UAAM,EAAE,IAAI,WAAW,IAAI,UAAU,OAAO,CAAC;AAC7C,QAAI,eAAe,MAAM,QAAQ;AAC7B,YAAM,IAAI,6BAAU,yCAAyC,MAAM,SAAS,UAAU,QAAQ;AAAA,IAClG;AACA,WAAO;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,gBAAgB,MAAqF;AACjG,UAAM,EAAE,IAAI,WAAW,OAAO,IAAI;AAClC,WAAO,6BAAW,OAAO,EAAE,KAAK,GAAG,KAAK,WAAW,GAAG,GAAG,IAAI,QAAQ,UAAU,CAAC;AAAA,EACpF;AACJ;",
+  "names": []
+}

package/dist/cjs/dtls/ecjpake/SchnorrZkp.d.ts

@@ -0,0 +1,60 @@
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * Schnorr zero-knowledge proof of knowledge of `x` such that `X = x*G`,
+ * matching the EC-JPAKE wire shape used by mbedTLS v3.6.6 / draft-cragie-tls-ecjpake-01.
+ *
+ * Wire fields:
+ * - `V`: ephemeral commitment point `v*G`, SEC1 uncompressed (`0x04 || X || Y`, 65 bytes for P-256).
+ * - `r`: scalar response `v - h*x mod n`, minimal big-endian (leading zeros stripped).
+ *
+ * The `h` challenge is hashed over `len(G)||G || len(V)||V || len(X)||X || len(ID)||ID`,
+ * each `len` a 4-byte big-endian integer (mbedTLS `ecjpake_hash`, ecjpake.c v3.6.6 §190-238).
+ */
+export interface SchnorrZkp {
+    /** SEC1-uncompressed encoding of `V = v*G`. */
+    V: Uint8Array;
+    /** Minimal big-endian encoding of `r = v - h*x mod n`. */
+    r: Uint8Array;
+}
+declare const Point: import("@noble/curves/abstract/weierstrass.js").WeierstrassPointCons<bigint>;
+/**
+ * Optional generator override. When omitted the curve base point `G` is used,
+ * matching round-1 ZKPs. Round 2 passes a composite point (e.g. `X1 + X2 + X3`)
+ * and must supply both `point` (for arithmetic) and `bytes` (for the hash
+ * preimage, since mbedTLS hashes the SEC1-uncompressed encoding verbatim).
+ */
+export interface SchnorrZkpGenerator {
+    point: InstanceType<typeof Point>;
+    bytes: Uint8Array;
+}
+export declare const SchnorrZkp: {
+    /**
+     * Generate a Schnorr ZKP for `(x, X = x*G)`. `G` defaults to the curve generator;
+     * pass `generator` for the round-2 composite-generator case.
+     *
+     * The caller must supply both `x` and the SEC1 encoding of `X` to keep the call site
+     * identical to the verification path (no implicit recomputation).
+     *
+     * `ephemeral` is the per-proof scalar `v`; in production it must be sampled
+     * uniformly from `[1, n-1]`. Tests pass a fixed value so the proof is deterministic.
+     */
+    generate(args: {
+        privateKey: bigint;
+        publicKey: Uint8Array;
+        ephemeral: bigint;
+        id: string;
+        generator?: SchnorrZkpGenerator;
+    }): SchnorrZkp;
+    verify(args: {
+        zkp: SchnorrZkp;
+        publicKey: Uint8Array;
+        id: string;
+        generator?: SchnorrZkpGenerator;
+    }): boolean;
+};
+export {};
+//# sourceMappingURL=SchnorrZkp.d.ts.map

package/dist/cjs/dtls/ecjpake/SchnorrZkp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SchnorrZkp.d.ts","sourceRoot":"","sources":["../../../../src/dtls/ecjpake/SchnorrZkp.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH;;;;;;;;;;GAUG;AACH,MAAM,WAAW,UAAU;IACvB,+CAA+C;IAC/C,CAAC,EAAE,UAAU,CAAC;IACd,0DAA0D;IAC1D,CAAC,EAAE,UAAU,CAAC;CACjB;AAED,QAAA,MAAM,KAAK,8EAAa,CAAC;AAiFzB;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAChC,KAAK,EAAE,YAAY,CAAC,OAAO,KAAK,CAAC,CAAC;IAClC,KAAK,EAAE,UAAU,CAAC;CACrB;AAYD,eAAO,MAAM,UAAU;IACnB;;;;;;;;;OASG;IACH,QAAQ,OAAO;QACX,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,UAAU,CAAC;QACtB,SAAS,EAAE,MAAM,CAAC;QAClB,EAAE,EAAE,MAAM,CAAC;QACX,SAAS,CAAC,EAAE,mBAAmB,CAAC;KACnC,GAAG,UAAU;IAkBd,MAAM,OAAO;QAAE,GAAG,EAAE,UAAU,CAAC;QAAC,SAAS,EAAE,UAAU,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,mBAAmB,CAAA;KAAE,GAAG,OAAO;CA0BxG,CAAC"}

package/dist/cjs/dtls/ecjpake/SchnorrZkp.js

@@ -0,0 +1,162 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var SchnorrZkp_exports = {};
+__export(SchnorrZkp_exports, {
+  SchnorrZkp: () => SchnorrZkp
+});
+module.exports = __toCommonJS(SchnorrZkp_exports);
+var import_general = require("@matter/general");
+var import_nist = require("@noble/curves/nist.js");
+var import_sha2 = require("@noble/hashes/sha2.js");
+var import_DtlsChannel = require("../channel/DtlsChannel.js");
+/**
+ * @license
+ * Copyright 2022-2026 Matter.js Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+const Point = import_nist.p256.Point;
+const N = Point.Fn.ORDER;
+const POINT_LEN = 65;
+function be32(value) {
+  const out = new Uint8Array(4);
+  new DataView(out.buffer).setUint32(0, value, false);
+  return out;
+}
+function hashChallenge(args) {
+  const { gBytes, vBytes, xBytes, idBytes } = args;
+  const total = 4 + gBytes.length + 4 + vBytes.length + 4 + xBytes.length + 4 + idBytes.length;
+  const buf = new Uint8Array(total);
+  let p = 0;
+  buf.set(be32(gBytes.length), p);
+  p += 4;
+  buf.set(gBytes, p);
+  p += gBytes.length;
+  buf.set(be32(vBytes.length), p);
+  p += 4;
+  buf.set(vBytes, p);
+  p += vBytes.length;
+  buf.set(be32(xBytes.length), p);
+  p += 4;
+  buf.set(xBytes, p);
+  p += xBytes.length;
+  buf.set(be32(idBytes.length), p);
+  p += 4;
+  buf.set(idBytes, p);
+  const digest = (0, import_sha2.sha256)(buf);
+  let h = 0n;
+  for (const byte of digest) {
+    h = h << 8n | BigInt(byte);
+  }
+  return h % N;
+}
+function bigintToMinimalBE(value) {
+  if (value < 0n) {
+    throw new import_general.InternalError("Schnorr response scalar must be non-negative");
+  }
+  if (value === 0n) {
+    return new Uint8Array(0);
+  }
+  const tmp = new Array();
+  let v = value;
+  while (v > 0n) {
+    tmp.push(Number(v & 0xffn));
+    v >>= 8n;
+  }
+  return Uint8Array.from(tmp.reverse());
+}
+function bigintFromBE(bytes) {
+  let v = 0n;
+  for (const byte of bytes) {
+    v = v << 8n | BigInt(byte);
+  }
+  return v;
+}
+function getBaseGBytes() {
+  return Point.BASE.toBytes(false);
+}
+function pointFromBytes(bytes) {
+  if (bytes.length !== POINT_LEN || bytes[0] !== 4) {
+    throw new import_DtlsChannel.DtlsError(
+      `expected SEC1-uncompressed P-256 point (65 bytes, 0x04 prefix), got len=${bytes.length} head=${bytes[0]}`
+    );
+  }
+  return Point.fromBytes(bytes);
+}
+function generatorOrBase(g) {
+  if (g) {
+    if (g.bytes.length !== POINT_LEN || g.bytes[0] !== 4) {
+      throw new import_general.InternalError("generator bytes must be SEC1-uncompressed P-256 (65 bytes, 0x04 prefix)");
+    }
+    return g;
+  }
+  return { point: Point.BASE, bytes: getBaseGBytes() };
+}
+const SchnorrZkp = {
+  /**
+   * Generate a Schnorr ZKP for `(x, X = x*G)`. `G` defaults to the curve generator;
+   * pass `generator` for the round-2 composite-generator case.
+   *
+   * The caller must supply both `x` and the SEC1 encoding of `X` to keep the call site
+   * identical to the verification path (no implicit recomputation).
+   *
+   * `ephemeral` is the per-proof scalar `v`; in production it must be sampled
+   * uniformly from `[1, n-1]`. Tests pass a fixed value so the proof is deterministic.
+   */
+  generate(args) {
+    const { privateKey, publicKey, ephemeral, id } = args;
+    if (ephemeral <= 0n || ephemeral >= N) {
+      throw new import_general.InternalError("ephemeral scalar must be in [1, n-1]");
+    }
+    if (privateKey <= 0n || privateKey >= N) {
+      throw new import_general.InternalError("private key scalar must be in [1, n-1]");
+    }
+    const g = generatorOrBase(args.generator);
+    const V = g.point.multiply(ephemeral);
+    const vBytes = V.toBytes(false);
+    const idBytes = new TextEncoder().encode(id);
+    const h = hashChallenge({ gBytes: g.bytes, vBytes, xBytes: publicKey, idBytes });
+    const rBig = ((ephemeral - h * privateKey % N) % N + N) % N;
+    return { V: vBytes, r: bigintToMinimalBE(rBig) };
+  },
+  verify(args) {
+    const { zkp, publicKey, id } = args;
+    const idBytes = new TextEncoder().encode(id);
+    let g;
+    let V;
+    let X;
+    try {
+      g = generatorOrBase(args.generator);
+      V = pointFromBytes(zkp.V);
+      X = pointFromBytes(publicKey);
+    } catch {
+      return false;
+    }
+    if (V.is0() || X.is0()) {
+      return false;
+    }
+    const r = bigintFromBE(zkp.r);
+    if (r >= N) {
+      return false;
+    }
+    const h = hashChallenge({ gBytes: g.bytes, vBytes: zkp.V, xBytes: publicKey, idBytes });
+    const lhs = g.point.multiplyUnsafe(r).add(X.multiplyUnsafe(h));
+    return lhs.equals(V);
+  }
+};
+//# sourceMappingURL=SchnorrZkp.js.map